What:
Dovetail will provide a way to authenticate the integrity for both dovetail tool and report.
With this approach, dovetail generates a digital signature along with the plain-text report . Then the reviewer can use this signature to validate the integrity of the dovetail tool and the report.
Why:
The report in plain-text is vulnerable, can be easily modified during storage and transportation.
Reviewer needs to make sure that the report is generated by a validated tool from the release and its result can not be modified to remove a failure or something like that.
Users do not need to know or learn any details about this procedure.
How:
The whole authenticating workflow show as following:
1. OPNFV generates the key pairs for each release
2. Dovetail uses this key and hash value of the dovetail tool to build a binary signature tool
3. Users begin to run the dovetail tool, the dovetail tool will generate the report in memory, and then use the signature tool to check the integrity of dovetail tool, then sign the report
4. Dovetail tool saves the report to a report file
5. Users then can upload report and signature to the reviewer
6. Reviewer can get a public key from OPNFV to extract digest from signature
7. Then reviewer can validate the integrity of the report
.png?version=2&modificationDate=1484901671000&cacheVersion=1&api=v2)